Blog Post
DarkMe Email Campaign Broadens Targeting For APT RAT
DarkMe, an APT-linked VB6 RAT known for using zero day exploits, turned up in two Huntress incidents stripped down to a plain .pif infostealer malware.
Blog Posts By This Author
All Categories
- Read more about DarkMe Email Campaign Broadens Targeting For APT RAT
- Read more about Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like ActivityBlog Post
Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity
Huntress is tracking a pattern across multiple customer environments where rogue ScreenConnect clients repeatedly spawn the Windows Script Host to execute a series of four VBScript files.
- Read more about Inside Knight Office, a New M365 AiTM Phishing KitBlog Post
Inside Knight Office, a New M365 AiTM Phishing Kit
An inside look at Knight Office, a newly discovered AiTM phishing kit featuring custom control panels, Cloudflare Turnstile, and M365 Token theft.
- Read more about PaperCut Actively Exploited: A Pre-Auth RCE ChainBlog Post
PaperCut Actively Exploited: A Pre-Auth RCE Chain
UPDATED: PaperCut NG and PaperCut MF are under active exploitation. Huntress reproduced a pre-auth RCE chain and shares urgent patching, exposure, and detection guidance.
- Read more about Wallet-Depleting macOS Malware Wants Your CryptoBlog Post
Wallet-Depleting macOS Malware Wants Your Crypto
A ClickFix scam tricked a Mac user into running a Terminal command that installed Go-based malware able to steal Keychain passwords and drain crypto wallets.
- Read more about Fake Bank of America "Action Needed" Phishing Email Deposits ScreenConnect InsteadBlog Post
Fake Bank of America "Action Needed" Phishing Email Deposits ScreenConnect Instead
A fake Bank of America phishing email kicks off a multi-stage malware infection chain. See how one convincing bank scam unravels.
